Network flow collection method, system and equipment for multi-mode network and medium

Abstract

The invention discloses a network flow collection method, system and device for a multi-modal network and a medium, and relates to the technical field of network flow collection, and the method comprises the steps: forwarding a new modal description file to a programmable network node and a flow analysis server through a controller; generating a forwarding program through the programmable network node according to the new modal description file and then notifying the controller; creating an analysis field structural body according to the new modal description file through a flow analysis server, creating a new statistical table, and notifying the controller; and after the controller receives notification messages of the programmable network node and the flow analysis server, issuing an update configuration instruction to the programmable network node in the new modal description file through the controller, so that the flow analysis server analyzes the new record data by using the analysis field structural body after receiving the new record data sent by the programmable network node. And storing the analyzed data into a new statistical table. And the network traffic can be flexibly acquired.

Description

Technical Field

[0001] The present application relates to the technical field of network traffic collection, and in particular to a network traffic collection method, system, device and medium for a multimodal network. Background Art

[0002] sFlow is a network monitoring technology jointly developed by three network equipment suppliers, HP, InMon and Foundry. It uses push technology to send reports to collectors and has formed a standard network export protocol (RFC3176). This technology uses built-in chips instead of software-based technology, which can eliminate the CPU memory burden of the device; and because the agent is embedded in the router or switch, sFlow can monitor and obtain basic network data information in large-scale and ultra-large-scale networks 24 hours a day, thus providing data for comprehensive network security analysis.

[0003] The new modality network is designed to break through the bottleneck of network service efficiency caused by the single IP bearer, and to address the problem of mismatch between content location, geographic location, identity location and IP identification. Relying on the national key research and development plan "Multimodal Intelligent Network Control Technology and System for Co-management and Co-governance", the team of Academician Wu Jiangxing proposed the "full-dimensional definable multimodal intelligent network PINet" for multimodal presentation of each layer of the network. This network system is committed to changing the traditional single baseline technology to meet the expansion of new addressing and routing mechanisms and the evolution and development of Internet technology. The new modality network emphasizes that the network layer can be customized, that is, it can be incompatible with TCP / IP. The sFlow protocol based on the IP network cannot be applied in the new modality experimental environment. For example, in the information center network taking the NDN network as an example, the core content changes from IP host interconnection to data content interconnection. The core object is information. All information units are named by data names instead of host identifiers. The sFlow agent cannot collect relevant data.

[0004] Although sFlow already supports many packet content extraction functions, such as Raw packet (raw packet interception), IPv4 Data, IPv6 Data and other network protocols, it only fully supports the traffic collection functions of IPv4 and IPv6 in TCP / IP networks. New modality networks have multiple identification spaces, such as "IP identification" and "content identification", which can support the coexistence of routing and addressing methods between multiple identification networks. The experimental environment constructed by new modality network instances (such as NDN networks) cannot use sFlow technology to monitor the traffic and devices in the experimental environment in real time. It can only customize the sFlow processing logic for each device in the experimental environment. The chip cost is relatively high, and the traffic monitoring system also needs to be redeveloped, which cannot meet the new network architecture that will emerge in the future new modality experimental environment.

[0005] The above contents are only used to assist in understanding the technical solution of the present application and do not constitute an admission that the above contents are prior art. Summary of the invention

[0006] The main purpose of this application is to provide a network traffic collection method, system, device and medium for multimodal networks, aiming to solve the technical problem that the experimental environment constructed by a new modality network instance cannot use sFlow technology to monitor the traffic and devices of the experimental environment in real time.

[0007] To achieve the above objectives, the present application proposes a network traffic collection method for a multimodal network, the network traffic collection method for a multimodal network comprising:

[0008] Applied to a network traffic collection system, the network collection system includes a controller, a programmable network node and a traffic analysis server; wherein the method includes:

[0009] forwarding the new modality description file to the programmable network node and the traffic analysis server via the controller;

[0010] Generating a forwarding program according to the new modality description file through the programmable network node and then notifying the controller;

[0011] The traffic analysis server creates a parsing field structure according to the new modality description file, and notifies the controller after creating a new statistical table;

[0012] After the controller receives notification messages from the programmable network node and the traffic analysis server, the controller sends update configuration instructions to the programmable network node in the new modal description file, so that the traffic analysis server uses the parsing field structure to parse the new record data sent by the programmable network node after receiving it, and stores the parsed data in the new statistical table to complete the traffic recording of the new modal network.

[0013] In one embodiment, the step of forwarding the new modality description file to the programmable network node and the traffic analysis server by the controller includes:

[0014] Upon receiving a new modality description file submitted by a user, the controller detects whether a tag value in the new modality description file is consistent with an existing tag value;

[0015] When it is detected that the tag value in the new modality description file is inconsistent with the existing tag value, the new modality description file is forwarded to the programmable network node and the traffic analysis server through the controller.

[0016] In one embodiment, the step of forwarding the new modality description file to the programmable network node and the traffic analysis server by the controller includes:

[0017] The new modality description file is forwarded to the programmable network node and the traffic analysis server through the control channel of the controller, wherein the control channel is the control channel between the programmable network node and the controller, and sFlow related message types are added to the control channel.

[0018] In one embodiment, the programmable network node includes a forwarding module, an sFlow agent, and a control service module; wherein the step of generating a forwarding program according to the new modality description file by the programmable network node and notifying the controller includes:

[0019] Sending the new modality description file to the sFlow agent and the forwarding module simultaneously through the control service module;

[0020] Parsing the traffic collection field according to the new modality description file through the sFlow agent, generating a forwarding program after constructing a new message structure, and notifying the control service module;

[0021] Parsing the traffic collection field according to the new modality description file through the forwarding module, setting a new modality traffic buffer area according to the field length of the traffic collection field, and notifying the control service module;

[0022] The controller is notified of the parsing results of the sFlow agent and the forwarding module through the control service module.

[0023] In one embodiment, the forwarding module includes a first expandable function and a second expandable function; wherein the step of parsing the traffic collection field according to the new modality description file by the forwarding module and setting the new modality traffic buffer area according to the field length of the traffic collection field includes:

[0024] Parsing the new modality description file through the first extensible function, and outputting a collection field structure;

[0025] A new modal traffic buffer area under a new network structure is created through the second scalable function according to the field length of the acquisition field structure and the adjustment parameters.

[0026] In one embodiment, the forwarding module further includes a third scalable function and a fourth scalable function; wherein, after the step of creating a new modal traffic buffer under a new network structure according to the field length and adjustment parameters of the acquisition field structure through the second scalable function, the step further includes:

[0027] Clear the acquisition cache of the previous network structure through the third scalable function;

[0028] The data packet to be forwarded is parsed by the fourth scalable function, and a collection field structure instance queue is output.

[0029] In one embodiment, the new modality description file includes a node IP description, a datagram header tag value, and a record type description structure.

[0030] In addition, to achieve the above purpose, the present application also proposes a network traffic collection system for a multimodal network, and the network traffic collection system for a multimodal network includes:

[0031] A controller, configured to forward a new modality description file to the programmable network node and the traffic analysis server, wherein the new modality description file includes a node IP description, a datagram header tag value, and a record type description structure;

[0032] A programmable network node, configured to generate a forwarding program according to the new modality description file and then notify the controller;

[0033] A traffic analysis server, used for creating a parsing field structure according to the new modality description file, and notifying the controller after creating a new statistical table;

[0034] The controller is used to send update configuration instructions to the programmable network node in the new modal description file after receiving notification messages from the programmable network node and the traffic analysis server, so that the traffic analysis server uses the parsing field structure to parse the new record data sent by the programmable network node after receiving it, and stores the parsed data in the new statistical table to complete the traffic record of the new modal network.

[0035] In addition, to achieve the above-mentioned purpose, the present application also proposes a network traffic collection device for a multimodal network, the device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the network traffic collection method for a multimodal network as described above.

[0036] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by the processor, the steps of the network traffic collection method for a multimodal network as described above are implemented.

[0037] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, it implements the steps of the network traffic collection method for a multimodal network as described above.

[0038] One or more technical solutions proposed in this application have at least the following technical effects:

[0039] The network traffic collection method, system, device and medium for multimodal networks proposed in the present application forward the new modal description file to the programmable network node and the traffic analysis server through the controller; the programmable network node generates a forwarding program according to the new modal description file and notifies the controller; the traffic analysis server creates a parsing field structure according to the new modal description file and notifies the controller after creating a new statistical table; after the controller receives the notification message from the programmable network node and the traffic analysis server, the controller sends an update configuration instruction to the programmable network node in the new modal description file, so that the traffic analysis server uses the parsing field structure to parse the new record data sent by the programmable network node, and stores the parsed data in the new statistical table to complete the new modal network. The traffic records of the network solve the technical problem that the experimental environment constructed by the new modality network instance cannot use sFlow technology to monitor the traffic and equipment in the experimental environment in real time. Compared with the existing technology, the present application innovatively uses the idea of ​​SDN network controller, and sends the new modality description file to the programmable network node and the traffic analysis server at the same time through the control channel of the controller. After receiving the new modality description file, the programmable network node parses and constructs the traffic collection field structure and generates the corresponding forwarding program. At the same time, the traffic analysis server dynamically generates a new data table structure according to the new modality description file. When the programmable network node pushes the sFlow data packet to the traffic analysis server, the traffic analysis server can parse the meaning of each field in the sFlow data packet and save it to the relevant traffic statistics table, thereby solving the traffic collection problem of various new network structures in the experimental environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0041] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0042] Figure 1 A flowchart of a method for collecting network traffic in a multimodal network according to a first embodiment of the present invention;

[0043] Figure 2 A format description diagram of an sFlow data packet provided in Embodiment 1 of the network traffic collection method for a multimodal network of the present application;

[0044] Figure 3 A diagram showing the meaning of fields in the Flow data header in sFlow provided in the first embodiment of the network traffic collection method for a multimodal network of the present application;

[0045] Figure 4 A network traffic collection system deployment diagram provided for the first embodiment of the network traffic collection method for a multimodal network of the present application;

[0046] Figure 5 A flow chart of a second embodiment of a method for collecting network traffic in a multimodal network according to the present invention;

[0047] Figure 6 A schematic diagram of a network traffic collection process provided for a multimodal network network traffic collection method embodiment 2 of the present application;

[0048] Figure 7 This is a schematic diagram of the module structure of a network traffic collection system for a multimodal network according to an embodiment of the present application;

[0049] Figure 8 Schematic diagram of the device structure of the hardware operating environment involved in the network traffic collection method for multimodal networks in the embodiment of the present application.

[0050] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0051] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0052] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0053] The main solution of the embodiment of the present application is: forwarding the new modal description file to the programmable network node and the traffic analysis server through the controller, wherein the new modal description file includes a node IP description, a data header tag value and a record type description structure; the programmable network node generates a forwarding program according to the new modal description file and then notifies the controller; the traffic analysis server creates a parsing field structure according to the new modal description file, and notifies the controller after creating a new statistical table; after the controller receives the notification message from the programmable network node and the traffic analysis server, the controller sends an update configuration instruction to the programmable network node in the new modal description file, so that the traffic analysis server uses the parsing field structure to parse the new record data sent by the programmable network node, and stores the parsed data in the new statistical table to complete the traffic recording of the new modal network.

[0054] From the above embodiments, it can be seen that the new modal description file is forwarded to the programmable network node and the traffic analysis server through the controller; the programmable network node generates a forwarding program according to the new modal description file and then notifies the controller; the traffic analysis server creates a parsing field structure according to the new modal description file, and notifies the controller after creating a new statistical table; after the controller receives the notification message from the programmable network node and the traffic analysis server, the controller sends an update configuration instruction to the programmable network node in the new modal description file, so that the traffic analysis server uses the parsing field structure to parse the new record data sent by the programmable network node after receiving it, and stores the parsed data in the new statistical table to complete the traffic record of the new modal network, thereby solving the problem caused by The experimental environment constructed by the new modal network instance cannot use sFlow technology to perform real-time monitoring of the traffic and equipment in the experimental environment. Compared with the existing technology, the present application innovatively uses the idea of ​​SDN network controller to uniformly send the new modal description file to the programmable network node and the traffic analysis server through the control channel of the controller. After receiving the new modal description file, the programmable network node parses and constructs the traffic collection field structure and generates the corresponding forwarding program. At the same time, the traffic analysis server dynamically generates a new data table structure according to the new modal description file. When the programmable network node pushes the sFlow data packet to the traffic analysis server, the traffic analysis server can parse the meaning of each field in the sFlow data packet and save it to the relevant traffic statistics table, thereby solving the traffic collection problem of various new network structures in the experimental environment.

[0055] It should be noted that the execution subject of this embodiment can be a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc., or an electronic device capable of realizing the above functions, a network traffic collection device for a multimodal network, etc. The following takes the network traffic collection for a multimodal network as an example to illustrate this embodiment and the following embodiments.

[0056] Based on this, the embodiment of the present application provides a network traffic collection method for a multimodal network. Figure 1 , Figure 1 This is a flow chart of the first embodiment of the network traffic collection method for multimodal networks of the present application.

[0057] In this embodiment, the network traffic collection method for a multimodal network includes steps S10 to S40:

[0058] Step S10, forwarding the new modality description file to the programmable network node and the traffic analysis server through the controller;

[0059] It should be noted that the new modal description file is designed based on the sFlow v5 data format, and the new sFlow datagram definition is imported through the new modal description file. The sFlow message is encapsulated in UDP and uses the well-known port 6343 for communication by default.

[0060] It should be noted that if Figure 2 As shown in the figure, the sFlow data packet is divided into a packet header and an sFlow datagram. The datagram is further subdivided into a datagram header and sampling data. The sampling data includes a sampling header and sampling records. There are multiple types of sFlow datagrams, and there are also multiple sampling records in each sFlow datagram. This nested definition form enables the sFlow data packet to contain rich sampling information.

[0061] It should be noted that in order to utilize existing sFlow collection tools, the type and record type of the sFlow datagram header in the new mode description file cannot conflict with the existing types.

[0062] It should be noted that for the header of the sFlow data packet, the control protocol of the new modal network is still through the IP network, and the sFlow header remains unchanged. For the sFlow datagram header, there are two types of datagram headers: flow and counter. Figure 3The information of the Flow datagram header is displayed. The first field is the datagram Tag, which needs to be defined in the new mode description file. The first 20 bits are the company number and the 12 bits are the format number. The company number cannot be defined as 0. The other fields follow the definition of sFlow. For the Counting type header, the first Tag field also needs to be redefined, and the other fields follow the definition of sFlow. Therefore, in the datagram header part, the description file only needs to define the Tag value, but it cannot conflict with the previously defined ones.

[0063] It should be noted that there are many types of sample record formats. In the sFlow protocol, the format descriptions of Raw packet, Ethernet Frame Data, IPv4 Data, and IPv6 Data have been defined in the Flow sample datagram. For the network structure of the new mode, it is necessary to customize the relevant structure and parse and implement it in the sFlow Agent. The record format needs to be described in the new mode description file.

[0064] In a feasible implementation manner, the new modality description file includes a node IP description, a datagram header tag value, and a record type description structure.

[0065] It should be noted that the new modal description file includes three aspects:

[0066] 1. Node IP description. The purpose of configuring this is that nodes that do not participate in the experiment do not need to undergo sFlowAgent transformation.

[0067] 2. Datagram header Tag (i.e., datagram header tag value), which can describe the types of Flow and Counter respectively;

[0068] 3. Record type description structure.

[0069] In a feasible implementation, the step of forwarding the new modal description file to the programmable network node and the traffic analysis server through the controller includes: when receiving a new modal description file submitted by a user, detecting by the controller whether the tag value in the new modal description file is consistent with the existing tag value; when it is detected that the tag value in the new modal description file is inconsistent with the existing tag value, forwarding the new modal description file to the programmable network node and the traffic analysis server through the controller.

[0070] In the specific implementation, after the controller is initialized, the user submits a new modal description file on the controller. The controller parses the new modal description file and detects whether the newly defined Tag value in the new modal description file conflicts with the existing datagram type and record type (that is, the newly defined Tag value is the same as the existing Tag value). If there is a conflict, the new modal description file needs to be redefined based on the conflict information and resubmitted by the user on the controller; if there is no conflict, the controller will issue the new modal description file to the programmable network nodes and sFlow Collector (that is, the traffic analysis server) specified by the new modal description file.

[0071] Step S20, generating a forwarding program according to the new modality description file through the programmable network node and notifying the controller;

[0072] It should be noted that if the programmable network node and the traffic analysis server receive a new modal description file, they need to return successful reception information to the controller through the control channel between the controller and the programmable network node; otherwise, an error is reported.

[0073] Step S30, creating a parsing field structure according to the new modality description file through the traffic analysis server, and notifying the controller after creating a new statistical table;

[0074] It should be noted that the Collector (i.e., the traffic analysis server) parses the new modality description file, creates a structure of parsed fields, creates related statistical tables, and notifies the controller.

[0075] Step S40, after the controller receives notification messages from the programmable network node and the traffic analysis server, the controller sends update configuration instructions to the programmable network node in the new modal description file, so that the traffic analysis server uses the parsing field structure to parse the new record data sent by the programmable network node after receiving it, and stores the parsed data in the new statistical table to complete the traffic record of the new modal network.

[0076] It should be noted that after the controller receives the message that the forwarding modules and sFlow Agents (i.e., sFlow agents) of all programmable network nodes and the traffic analysis server are successfully configured, it generates a configuration completion message; after the user receives the configuration completion message, the controller sends a command to update the sFlow configuration to the programmable network nodes specified in the new modal description file. The programmable network nodes do not need to be restarted and can directly start sFlow collection for the new modal network; the traffic analysis server receives the sFlow containing new records, uses the new structure to parse the UDP data packet, stores it in the new statistical table, and finally completes the traffic record of the new modal network.

[0077] In the specific implementation, Figure 4 As shown in the network traffic collection system deployment diagram, the new modality description file is sent to the programmable network node and the sFlow collector (ie, the traffic analysis server) through the control channel of the controller.

[0078] In this embodiment, the controller forwards the new modality description file to the programmable network node and the traffic analysis server; the programmable network node generates a forwarding program according to the new modality description file and notifies the controller; the traffic analysis server creates a parsing field structure according to the new modality description file, and notifies the controller after creating a new statistical table; after the controller receives the notification message from the programmable network node and the traffic analysis server, the controller sends an update configuration instruction to the programmable network node in the new modality description file, so that the traffic analysis server uses the parsing field structure to parse the new record data sent by the programmable network node, and stores the parsed data in the new statistical table to complete the traffic record of the new modality network, thereby solving the problem of traffic recording caused by the new modality. The experimental environment constructed by the network instance cannot use sFlow technology to perform real-time monitoring of the traffic and equipment in the experimental environment. Compared with the existing technology, the present application innovatively uses the idea of ​​SDN network controller to uniformly send the new modal description file to the programmable network node and the traffic analysis server through the control channel of the controller. After receiving the new modal description file, the programmable network node parses and constructs the traffic collection field structure and generates the corresponding forwarding program. At the same time, the traffic analysis server dynamically generates a new data table structure according to the new modal description file. When the programmable network node pushes the sFlow data packet to the traffic analysis server, the traffic analysis server can parse the meaning of each field in the sFlow data packet and save it to the relevant traffic statistics table, thereby solving the traffic collection problem of various new network structures in the experimental environment.

[0079] Based on the first embodiment of the present application, in the second embodiment of the present application, the same or similar contents as those in the above-mentioned embodiment 1 can be referred to the above introduction, and will not be repeated in the following. Figure 5 , the programmable network node includes a forwarding module, an sFlow agent and a control service module; the step S20 also includes:

[0080] Step S201, sending the new modality description file to the sFlow agent and the forwarding module simultaneously through the control service module;

[0081] It should be noted that, in a programmable network node, the node device management control service module (ie, the control service module) sends a new modality description file to both the sFlow Agent (ie, the sFlow agent) and the data packet forwarding module (ie, the forwarding module) at the same time.

[0082] Step S202, parsing the traffic collection field according to the new modality description file through the sFlow agent, constructing a new message structure, generating a forwarding program, and notifying the control service module;

[0083] It should be noted that the Agent parser in the sFlow agent can parse the new modality description file, create a structure of the collection field, modify the sFlow datagram encapsulation algorithm, and notify the node device management control service module.

[0084] Step S203, parsing the traffic collection field according to the new modality description file through the forwarding module, setting a new modality traffic buffer area according to the field length of the traffic collection field, and notifying the control service module;

[0085] It should be noted that the data packet forwarding module parses the new modality description file, creates a structure of parsed fields, destroys the previous collection field cache, creates a traffic collection field cache that adapts to the new structure, and notifies the node device management control service module.

[0086] Step S204: Notify the controller of the parsing results of the sFlow agent and the forwarding module through the control service module.

[0087] It should be noted that the node device management control service module notifies the controller of the parsing results of the Agent parser and the data packet forwarding module.

[0088] In the specific implementation, Figure 6 As shown in the figure, the new modality network traffic collection process is specifically as follows:

[0089] 1. Controller initialization;

[0090] 2. The user submits a new modal description file on the controller;

[0091] 3. Parse the new modal file to check whether it conflicts with the existing datagram type and record type (the newly defined Tag value is the same as the existing Tag value). If there is no conflict, continue to step 4. If there is a conflict, redefine the modal description file according to the conflict information and return to step 2 to submit;

[0092] 4. The controller distributes the description file to the programmable network nodes and sFlow Collector (i.e., traffic analysis server) specified in the description file;

[0093] 5. If the programmable network node and Collector receive the description file, they return the successful reception information to the controller through the control channel; otherwise, an error is reported;

[0094] 6. In the programmable network node, the node device management and control service module sends the new mode description file to both the sFlow Agent and the packet forwarding module;

[0095] 7. The Agent parser parses the description file, creates a structure for the collection field, modifies the sFlow datagram encapsulation algorithm, and notifies the node device management and control service module;

[0096] 8. The data packet forwarding module parses the description file, creates a structure of the parsed field, destroys the previous collection field cache, creates a flow collection field cache that adapts to the new structure, and notifies the node device management and control service module;

[0097] 9. The node device management control service module notifies the controller of the parsing results of the Agent parser and the data packet forwarding module;

[0098] 10. Collector parses the description file, creates a structure of parsed fields, creates related statistics tables, and notifies the controller;

[0099] 11. After receiving the successful configuration messages of the forwarding modules and sFlow Agents of all nodes and the Collector, the controller generates a configuration completion message.

[0100] 12. The user receives the configuration completion message and sends a command to update the sFlow configuration to the node specified in the description file through the controller. The node does not need to be restarted and directly starts sFlow collection for the new modality network;

[0101] 13.Colletor receives the sFlow containing the new record, uses the new structure to parse the UDP data packet, stores it in the new statistics table, and completes the flow record of the new modal network.

[0102] In a feasible implementation, the forwarding module includes a first expandable function and a second expandable function; wherein, the step of parsing the traffic collection field according to the new modality description file through the forwarding module and setting the new modality traffic buffer according to the field length of the traffic collection field includes: parsing the new modality description file through the first expandable function and outputting the collection field structure; creating a new modality traffic buffer under the new network structure according to the field length and adjustment parameters of the collection field structure through the second expandable function. The forwarding module also includes a third expandable function and a fourth expandable function; wherein, after the step of creating a new modality traffic buffer under the new network structure according to the field length and adjustment parameters of the collection field structure through the second expandable function, it also includes: clearing the collection buffer of the previous network structure through the third expandable function; parsing the data packet to be forwarded through the fourth expandable function and outputting the collection field structure instance queue.

[0103] It should be noted that the programmable network node is composed of a programmable switch. The traffic field collection method can be inserted into the forwarding module of the programmable network node to realize the dynamic collection of the traffic field. It includes 4 extensible functions. The specific description is as follows:

[0104] (1) The first extensible function:

[0105] Method: Description file parsing

[0106] Description: Parse the received description file and add the required operations to the data packet processing process.

[0107] Input: New modality description file

[0108] Output: Collection field structure

[0109] (2) The second extensible function:

[0110] Method: Create a field collection buffer

[0111] Note: Under the new network structure, the size of the buffer area should be set to N times the total length of the collection field. N is much larger than the total length of the collection field. The setting of N is related to the storage capacity of the collection node and can be adjusted according to the setting adjustment parameters.

[0112] Input: Collection field structure

[0113] Output: Suitable buffer

[0114] (3) The third extensible function:

[0115] Method: Field collection buffer destruction

[0116] Description: Clear the acquisition cache of the previous network structure.

[0117] Input: None

[0118] Output: Is it cleared?

[0119] (4) The fourth scalable function:

[0120] Method: Collect traffic

[0121] Description: Analyze the collected fields of the forwarded data packets and store them in the queue.

[0122] Input: Each forwarded packet

[0123] Output: Collection field structure instance queue

[0124] It should be noted that the first expandable function, the second expandable function and the third expandable function are used for modal description parsing of new modal files, and the fourth expandable function is used for collecting sFlow related field data during data packet processing.

[0125] It should be noted that the new modality description file specifies the node range, sFlow message type, record type, record structure and other information contained in the new modality network. These detailed provisions can be directly parsed into the corresponding structure in the sFlow Agent; they can be conveniently parsed into the flow record table structure of the Colletor. These make the new modality network environment measurable and reduce the development cost of the new system. The various configuration files of the new modality are transmitted through the control channel of the controller, which reduces the overhead of configuring each node separately. At the same time, the existing control channel message program can be used to expand a message type as soon as possible without redeveloping configuration submission programs; through the programmable characteristics of the node, the Agent parser can construct the structure of the sFlow message header and record body described in the description file. At the same time, in the data channel, it can collect traffic fields while parsing the data packet in layers during the forwarding process and store them in the cache area of ​​the data channel to achieve efficient collection without occupying additional resources at the data forwarding level; deploying related new collection tasks through the controller is conducive to the testing of the experimental environment of the new network system and the measurement of new applications. New applications can be quickly deployed under the new modality network, and detailed information such as the traffic usage and traffic path of the new application can be actually measured. In this way, when various new network structures are deployed in the experimental environment, the collector can perform traffic collection and device monitoring simply by creating some new tables and extending some processing functions.

[0126] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the network traffic collection method for multimodal networks of the present application. More simple transformations based on this technical concept are all within the scope of protection of the present application.

[0127] This application also provides a network traffic collection system for multimodal networks, please refer to Figure 7 , the network traffic collection system for multimodal networks includes:

[0128] The controller 10 is used to forward the new modality description file to the programmable network node and the traffic analysis server;

[0129] A programmable network node 20, configured to generate a forwarding program according to the new modality description file and then notify the controller;

[0130] The traffic analysis server 30 is used to create a parsing field structure according to the new modality description file, and notify the controller after creating a new statistical table;

[0131] The controller 10 is used to send update configuration instructions to the programmable network node in the new modal description file after receiving notification messages from the programmable network node and the traffic analysis server, so that the traffic analysis server uses the parsing field structure to parse the new record data sent by the programmable network node after receiving it, and stores the parsed data in the new statistical table to complete the traffic recording of the new modal network.

[0132] The network traffic collection system for multimodal networks provided by the present application adopts the network traffic collection method for multimodal networks in the above-mentioned embodiments, which can solve the technical problem that the experimental environment constructed by the new modal network instance cannot use sFlow technology to monitor the traffic and equipment of the experimental environment in real time. Compared with the prior art, the beneficial effects of the network traffic collection system for multimodal networks provided by the present application are the same as the beneficial effects of the network traffic collection method for multimodal networks provided by the above-mentioned embodiments, and other technical features of the network traffic collection system for multimodal networks are the same as the features disclosed in the above-mentioned embodiment methods, which will not be repeated here.

[0133] The present application provides a network traffic collection device for a multimodal network, and the network traffic collection device for a multimodal network includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the network traffic collection method for a multimodal network in the above-mentioned embodiment 1.

[0134] Reference below Figure 8 , which shows a schematic diagram of the structure of a network traffic collection device for a multimodal network suitable for implementing an embodiment of the present application. The network traffic collection device for a multimodal network in the embodiment of the present application may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 8 The network traffic collection device for a multimodal network shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0135] like Figure 8 As shown, the network traffic collection device for multimodal networks may include a processing device 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM: Random Access Memory) 1004. In RAM1004, various programs and data required for the operation of the network traffic collection device for multimodal networks are also stored. The processing device 1001, ROM1002, and RAM1004 are connected to each other via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to the I / O interface 1006: input devices 1007 including, for example, a touch screen, a touchpad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; output devices 1008 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 1003 including, for example, a magnetic tape, a hard disk, etc.; and communication devices 1009. The communication device 1009 can allow the network traffic collection device for a multimodal network to communicate with other devices wirelessly or wired to exchange data. Although the figure shows a network traffic collection device for a multimodal network with various systems, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems may be implemented or have alternatively.

[0136] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0137] The network traffic collection device for multimodal networks provided by the present application adopts the network traffic collection method for multimodal networks in the above-mentioned embodiment, which can solve the technical problem that the experimental environment constructed by the new modal network instance cannot use sFlow technology to monitor the traffic and equipment of the experimental environment in real time. Compared with the prior art, the beneficial effects of the network traffic collection device for multimodal networks provided by the present application are the same as the beneficial effects of the network traffic collection method for multimodal networks provided by the above-mentioned embodiment, and the other technical features of the network traffic collection device for multimodal networks are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0138] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0139] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A network traffic collection method for a multimodal network, characterized in that: Applied to a network traffic collection system, the network collection system includes a controller, a programmable network node and a traffic analysis server; wherein the method includes: forwarding the new modality description file to the programmable network node and the traffic analysis server via the controller; Generating a forwarding program according to the new modality description file through the programmable network node and then notifying the controller; The traffic analysis server creates a parsing field structure according to the new modality description file, and notifies the controller after creating a new statistical table; After the controller receives notification messages from the programmable network node and the traffic analysis server, the controller sends update configuration instructions to the programmable network node in the new modal description file, so that the traffic analysis server uses the parsing field structure to parse the new record data sent by the programmable network node after receiving it, and stores the parsed data in the new statistical table to complete the traffic recording of the new modal network.

2. The method according to claim 1, characterized in that The step of forwarding the new modality description file to the programmable network node and the traffic analysis server by the controller comprises: Upon receiving a new modality description file submitted by a user, the controller detects whether a tag value in the new modality description file is consistent with an existing tag value; When it is detected that the tag value in the new modality description file is inconsistent with the existing tag value, the new modality description file is forwarded to the programmable network node and the traffic analysis server through the controller.

3. The method according to claim 1, characterized in that The step of forwarding the new modality description file to the programmable network node and the traffic analysis server by the controller comprises: The new modality description file is forwarded to the programmable network node and the traffic analysis server through the control channel of the controller, wherein the control channel is the control channel between the programmable network node and the controller, and sFlow related message types are added to the control channel.

4. The method according to claim 1, characterized in that The programmable network node includes a forwarding module, an sFlow agent, and a control service module; wherein the step of generating a forwarding program according to the new modality description file by the programmable network node and then notifying the controller includes: Sending the new modality description file to the sFlow agent and the forwarding module simultaneously through the control service module; Parsing the traffic collection field according to the new modality description file through the sFlow agent, generating a forwarding program after constructing a new message structure, and notifying the control service module; Parsing the traffic collection field according to the new modality description file through the forwarding module, setting a new modality traffic buffer area according to the field length of the traffic collection field, and notifying the control service module; The controller is notified of the parsing results of the sFlow agent and the forwarding module through the control service module.

5. The method according to claim 4, characterized in that The forwarding module includes a first expandable function and a second expandable function; wherein the step of parsing the traffic collection field according to the new modality description file through the forwarding module and setting the new modality traffic buffer area according to the field length of the traffic collection field includes: Parsing the new modality description file through the first extensible function, and outputting a collection field structure; A new modal traffic buffer under a new network structure is created through the second scalable function according to the field length of the acquisition field structure and the adjustment parameters.

6. The method according to claim 5, characterized in that The forwarding module also includes a third scalable function and a fourth scalable function; wherein, after the step of creating a new modal traffic buffer under a new network structure according to the field length and adjustment parameters of the acquisition field structure through the second scalable function, the step also includes: Clear the acquisition cache of the previous network structure through the third scalable function; The data packet to be forwarded is parsed by the fourth scalable function, and a collection field structure instance queue is output.

7. The method according to claim 1, characterized in that The new modality description file includes a node IP description, a datagram header tag value, and a record type description structure.

8. A network traffic collection system for multimodal networks, characterized in that: The system comprises: A controller, configured to forward the new modality description file to the programmable network node and the traffic analysis server; A programmable network node, configured to generate a forwarding program according to the new modality description file and then notify the controller; A traffic analysis server, used for creating a parsing field structure according to the new modality description file, and notifying the controller after creating a new statistical table; The controller is used to send update configuration instructions to the programmable network node in the new modal description file after receiving notification messages from the programmable network node and the traffic analysis server, so that the traffic analysis server uses the parsing field structure to parse the new record data sent by the programmable network node after receiving it, and stores the parsed data in the new statistical table to complete the traffic record of the new modal network.

9. A network traffic collection device for multimodal networks, characterized in that: The device comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the network traffic collection method for a multimodal network as described in any one of claims 1 to 7.

10. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the network traffic collection method for a multimodal network as described in any one of claims 1 to 7 are implemented.

Images